CVE-2021-37580

CVE-2021-37580 POC for CVE-2021-37580 0x00 Vulnerability Principle Vulnerability principle: Apache ShenYu Admin bypass JWT authentication CVE-2021-37580 0x01 Single URL root@kitploit: Usage: python3 CVE-2021-37580.py -u url -n username.txt For shenyu-admin-2.4.0, vulnerable versions see below: Fo...

FUXA 1.3.0 - Unauthenticated ICS/SCADA Project Data Disclosure

FUXA v1.3.0 exposes full SCADA/HMI project configuration via GET /api/project without authentication, even when secureEnabled is true. The secureFnc middleware auto-generates a valid guest JWT when no token is provided, bypassing authentication. Exposed data includes server-side scripts, device...

CVE-2026-55040-Mass-Exploit

Exploit di Bypass del Token JWT per Microsoft SharePoint CVE-2026-55040, CVSS 9.1 Forgia token di autenticazione utilizzando tre vettori di attacco: Algoritmo "none" salta la verifica della firma Segreti HS256 deboli con supporto per attacco a forza bruta tramite dizionario Sostituzione della...

CVE-2026-63520

CVE-2026-63520 RCE por tipo inseguro no SharePoint + cadeia CVE-2026-55040 RCE não autenticado no Microsoft SharePoint Server. Nenhuma credencial necessária. Stephen Fewer Rapid7 demonstrou a CVE-2026-55040 no Pwn2Own Berlin 2026. A Rapid7 então descobriu a CVE-2026-63520 durante pesquisas de...

CVE-2026-77368 SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Paths

SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resumable-upload handler checks JWT allowedprefixes scoping only when a session is created, letting a low-privilege tenant hijack another tenant's upload session to write content to filer paths their o...

PT-2026-82325

Name of the Vulnerable Software and Affected Versions SeaweedFS versions prior to 4.40 Description The filer's TUS resumable-upload handler fails to verify JWT allowed prefixes scoping after a session is created. This allows a low-privilege tenant who obtains another user's session identifier to...

CVE-2026-67443

In FUXA ≤1.3.2, the allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity, so an unauthenticated attacker can obtain a signed guest token from POST /api/heartbeat and access the RED.httpAdmin editor. Wi...

CVE-2026-67443 FUXA: Unauthenticated guest JWT bypasses Node-RED secure-mode authorization gate (Remote Script Execution)

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity. When nodeRedEnabled is true, secureEnabled is tru...

CVE-2026-72605

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can registe...

CVE-2026-72605 Swing Music Swing Music - Missing Authentication

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can registe...

CVE-2026-72605

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can registe...

PT-2026-70149

Name of the Vulnerable Software and Affected Versions Swing Music version 3.0.0 Description A missing authentication issue allows unauthenticated remote attackers to create arbitrary user accounts. This occurs because the 'POST /auth/profile/create' endpoint is allowlisted from JWT JSON Web Token...

Envoy Gateway: xDS Control Plane Information Disclosure when operating in GatewayNamespaceMode

Impact When Envoy Gateway runs in GatewayNamespaceMode provider.kubernetes.deploy.type=GatewayNamespace, the xDS gRPC server is configured with a StreamInterceptor for JWT authentication but no UnaryInterceptor. The go-control-plane xDS server exposes both streaming and unary Fetch RPC methods fo...

NPM: 9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass

NPM: 9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass vulnerability discovered by ? in WordPress Npm 9router versions = 0.2.21, = 0.4.41...

GHSA-JPHH-M39H-6GWX 9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass

Summary 9router uses a publicly known hardcoded string "9router-default-secret-change-me" as the fallback of JWT secret for all Dashboard session JWTs when the JWTSECRET environment variable is not set. Because this secret is committed in the public repository and unchanged across all releases, a...

GO-2026-5390 MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path in github.com/Kuadrant/mcp-gateway

MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path in github.com/Kuadrant/mcp-gateway...

fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver

Summary A critical authentication-bypass vulnerability in fast-jwt's async key-resolver flow allows any unauthenticated attacker to forge arbitrary JWTs that are accepted as authentic. When the application's key resolver returns an empty string '', for example via the common keysdecoded.header.ki...

PT-2026-23790

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.13 Description Flowise has an issue where the NVIDIA NIM router endpoint '/api/v1/nvidia-nim/' was incorrectly whitelisted in the global authentication middleware. This allowed unauthenticated access to sensitive...

CVE-2026-29000

CVE-2026-29000 affects pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3. The issue is an authentication bypass in JwtAuthenticator when handling encrypted JWTs, enabling an attacker who has the server’s RSA public key to forge a JWE-wrapped PlainJWT with arbitrary subject and role claims. This...

CVE-2026-25554 OpenSIPS 3.1 <= 3.6.4 auth_jwt SQL Injection Enables JWT Authentication Bypass

OpenSIPS versions 3.1 before 3.6.4 containing the authjwt module prior to commit 3822d33 contain a SQL injection vulnerability in the jwtdbauthorize function in modules/authjwt/authorize.c when dbmode is enabled and a SQL database backend is used. The function extracts the tag claim from a JWT...